For Heads-of · Practitioner
Content Provenance
Verifiable information about where a piece of content came from and how it was made or changed, attached to the content itself. It is the technical basis for labelling AI-generated material, through standards such as C2PA Content Credentials and through watermarking.
- C2PA
- Content Credentials
- watermarking
- Article 50
- AI labelling
How it works
Two approaches complement each other. Provenance metadata, such as C2PA Content Credentials, attaches a cryptographically signed record of origin and edits to a file; the C2PA specification reached version 2.3 in January 2026 and is being fast-tracked as an ISO standard. Watermarking embeds a signal in the content itself, which can survive when metadata is stripped. Neither is foolproof: metadata can be removed and watermarks degraded.
The legal pull
The EU AI Act requires providers of generative systems to mark their output in a machine-readable way so it can be detected as AI-generated (Article 50(2)), and requires deployers to disclose deepfakes. The Commission's code of practice on marking and labelling, published in June 2026, sets out how. China's labelling measures, in force since September 2025, require both visible labels and embedded metadata.
Where it sits in the register
The register entry for failing to disclose AI-generated content is undisclosed AI interaction; the control is AI transparency and disclosure labelling.
Sources
Related Terms
Deepfake
AI-generated or manipulated image, audio or video content that resembles real people, objects, places or events and would falsely appear to a person to be authentic. For an organisation, the most immediate risk is impersonation fraud: a cloned voice or a faked video call instructing a payment.
EU AI Act
The European Union's regulation of AI systems by risk category, in force since 1 August 2024 and applying in stages. As of October 2026 the prohibitions, the AI literacy duty, the general-purpose model obligations and the Article 50 transparency duties all apply. The 2026 Digital Omnibus, Regulation (EU) 2026/1744, deferred the high-risk obligations to December 2027 and August 2028, softened the literacy duty and added two prohibitions. It reaches any organisation whose AI output is used in the EU, wherever the organisation sits.
Multimodal AI
AI systems that process and combine more than one type of data (text, images, audio, video) to understand and respond to the world.
Transparency
The disclosure of information about an AI system to the people who need it: that AI is being used, what it does, what it is for and what risks it poses, in terms they can understand. For people whose personal data it uses, being informed is also a legal right.